Critical Alert: Active Exploitation of Zero-Day Vulnerabilities in Microsoft Defender

In a critical security escalation, Microsoft has confirmed the active exploitation of two distinct zero-day vulnerabilities within the Microsoft Defender ecosystem. These vulnerabilities represent a sophisticated threat vector, as they target the very security software designed to protect the endpoint, effectively turning a primary line of defense into a potential entry point for attackers.

The vulnerabilities, identified as CVE-2026-41091 and CVE-2026-45498, were formally disclosed on May 19, 2026. Microsoft’s security advisory confirms that both flaws are currently being leveraged by threat actors in real-world environments.

CVE-2026-41091: High-Severity Privilege Escalation

The more critical of the two findings, CVE-2026-41091, carries a CVSS score of 7.8. From a technical standpoint, this is an elevation of privilege (EoP) vulnerability rooted in improper link resolution—specifically classified under CWE-59 (Improper Link Resolution before File Access). Essentially, the vulnerability allows a flaw in how the system handles file paths or symbolic links to be exploited during the file access process.

For security administrators, the implications are serious. An attacker possessing only low-level, non-privileged access to a system can exploit this flaw to gain elevated permissions. Because the attack complexity is rated as low and requires zero user interaction, it is a highly efficient mechanism for lateral movement and persistence. Once the escalation is successful, the attacker can compromise the entire triad of information security: confidentiality, integrity, and availability.

Microsoft has categorized the exploitation status as “Exploitation Detected.” While the formal exploit code maturity is currently unproven in a lab setting, the presence of active, real-world attack telemetry underscores the immediate need for remediation.

CVE-2026-45498: Denial-of-Service (DoS) Vector

The second vulnerability, CVE-2026-45498, is a Denial-of-Service (DoS) issue with a CVSS rating of 4.0. While it does not allow for data exfiltration or privilege escalation, its impact on operational continuity cannot be overlooked. This flaw allows a local attacker to trigger a state where Microsoft Defender becomes unresponsive or unstable.

In a high-stakes environment, a DoS attack against security software is often used as a tactical distraction. By disabling or destabilizing the endpoint protection agent, an attacker can create a “blind spot” in the environment, allowing them to execute further malicious activities—such as deploying ransomware—without being detected by real-time monitoring tools.

The Threat of Vulnerability Chaining

What makes these two vulnerabilities particularly dangerous is the potential for “vulnerability chaining.” Sophisticated threat actors, including those behind Advanced Persistent Threat (APT) campaigns, rarely rely on a single exploit. A common attack pattern involves using a low-privilege entry point (perhaps via phishing) to execute a DoS attack to mask their presence, followed immediately by using CVE-2026-41091 to seize full administrative control of the host.

Recommended Mitigation and Defense-in-Depth

Microsoft has released official security patches for both vulnerabilities. We strongly recommend that IT and security teams prioritize the deployment of these updates across all affected endpoints immediately.

Beyond immediate patching, organizations should adopt a proactive security posture:

• Endpoint Detection and Response (EDR): Utilize EDR tools to monitor for anomalous behavior that might indicate post-exploitation activity, such as unusual privilege shifts or unexpected system service restarts.
• Principle of Least Privilege (PoLP): Minimize the number of users with local administrative rights to reduce the initial attack surface available for these local exploits.
• Log Analysis: Review system and security logs for indicators of compromise (IoCs) related to link-following attempts or sudden Defender service failures.
• Continuous Monitoring: Maintain visibility into endpoint health to catch the “quiet” indicators of a DoS attack before it escalates into a full-scale breach.

The fact that these vulnerabilities exist within a security product serves as a critical reminder: no software is infallible, and the security tools we rely on must be treated as part of the active attack surface that requires constant vigilance and rapid patching.